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We reconsider the foundations of modal logic, following Martin-Lof 's methodology of 
distinguishing judgments from propositions. We give constructive meaning explanations 
for necessity and possibility which yields a simple and uniform system of natural 
deduction for intuitionistic modal logic which does not exhibit anomalies found in other 
proposals. We also give a new presentation of lax logic and find that the lax modality is 
already expressible using possibility and necessity. Through a computational 
interpretation of proofs in modal logic we further obtain a new formulation of Moggi's 
monadic metalanguage. 
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1. Introduction 

In this paper we reconsider the foundations of modal logic, following Martin-L6f 's (1996) 
methodology of distinguishing judgments from propositions. We give constructive mean- 
ing explanations for necessity (□) and possibility (O). This exercise yields a simple and 
uniform system of natural deduction for intuitionistic modal logic which does not exhibit 
anomalies found in other proposals. We also give a new presentation of lax logic (Fairt- 
lough and Mendler, 1997) and find that it is already contained in modal logic, using the 
decomposition of the lax modality OA as On A and lax implication A => B as (□ A) D B. 
Through a computational interpretation of proofs in modal logic we further obtain a 
new formulation of Moggi's monadic metalanguage (Moggi, 1998; 1989; 1991), combin- 
ing and systematizing previous work by S. Kobayashi (1997) and Benton, Bierman, and 
de Paiva (1998). 

At the level of judgments, the above development requires surprisingly few primitive 
notions. In particular, we only need hypothetical judgments to explain implication, and 
categorical judgments to explain the modalities. We have thus obtained a satisfactory 
foundation for the constructive understanding of modal logic and its computational in- 
terpretations. 

2. Judgments and Propositions 

In his Siena lectures from 1983 (finally published in 1996), Martin-L6f provides a founda- 
tion for logic based on a clear separation of the notions of judgment and proposition. He 
reasons that to judge is to know and that an evident judgment is an object of knowledge. 
A proof is what makes a judgment evident. In logic, we make particular judgments such 
as " A is a proposition" or 11 A is true" , presupposing in the latter case that A is already 
known to be a proposition. To know that U A is a proposition" means to know what 
counts as a verification of A, whereas to know that " A is true" means to know how to 
verify A. In his words (Martin-L6f, 1996, Page 27): 

The meaning of a proposition is determined by [. . . J what counts as a verification of it. 

This approach leads to a clear conceptual priority: we first need to understand the 
notions of judgment and evidence for judgments, then the notions of proposition and 
verifications of propositions to understand truth. 

As an example, we consider the explanation of conjunction. We know that A A B is a 
proposition if both A and B are propositions. As a rule of inference (called conjunction 
formation) : 



A prop 



B prop 



AF 



A A B prop 
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The meaning is given by stating what counts a verification of A A B. We say that we have 
a verification of A A B if we have verifications for both A and B. As a rule of inference: 

A true B true 

Al 

AAB true 

where we presuppose that A and B are already known to be propositions. This is known 
as an introduction rule, a term due to Gentzen (1935) who first formulated a system 
of natural deduction. Conversely, what do we know if we know that A A B is true? 
Since a verification of A A B consists of verifications for both A and B, we know that A 
must be true and B must be true. Formulated as rules of inference (called conjunction 
eliminations) : 

AAB true _ A A B true _ 
AE L AE R 

A true B true 

From the explanation above it should be clear that the two elimination rules are sound: 
if we define the meaning of conjunction by its introduction rule then we are fully justified 
in concluding that A is true if A A B is true, and similarly for the second rule. 

Soundness guarantees that the elimination rules are not too strong. We have sufficient 
evidence for the judgment in the conclusion if we have sufficient evidence for the judgment 
in the premise. This is witnessed by a local reduction which constructs evidence for the 
conclusion from evidence for the premise. 



V £ 

A true B true 



AI 



V 



A A B true A true 

■AE L 



A true 

A symmetric reduction exists for AEr. We only consider each elimination immediately 
preceded by an introduction for a connective. We therefore call the property that each 
such pattern can be reduced local soundness. 

The dual question, namely if the elimination rules are sufficiently strong, has, as far as 
we know, not been discussed by Martin-L6f. Of course, we can never achieve "absolute" 
completeness of rules for inferring evident judgments. But in some situations, elimination 
rules may be obviously incomplete. For example, we might have overlooked the second 
elimination rule for conjunction, AEr. This would not contradict soundness, but we 
would not be able to exploit the knowledge that AAB is true to its fullest. In particular, 
we cannot recover the knowledge that B is true even if we know that A A B is true. 

In general we say that the elimination rules for a connective are locally complete if we 
can apply the elimination rules to a judgment to recover enough knowledge to permit 
reconstruction of the original judgment. In the case of conjunction, this is only possible 
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if we have both elimination rules. 



V 

AAB true 



V 

A A B true 



V 

AAB true 



E 



A .El 



A true 



B true 



AI 



AAB true 



We call this pattern a local expansion since we obtain more complex evidence for the 
original judgment. 

An alternative way to understand local completeness is to reconsider our meaning 
explanation of conjunction. We have said that a verification of A A B consists of a verifi- 
cation of A and a verification of B. Local completeness entails that it is always possible 
to bring the verification of A A B into this form by a local expansion. 

To summarize, logic is based on the notion of judgment where an evident judgment 
is an object of knowledge. A judgment can be immediately evident or, more typically, 
mediately evident, in which case the evidence is provided by a proof. The meaning of a 
proposition is given by what counts as a verification of it. This is written out in the form 
of introduction rules for logical connectives which allow us to conclude when propositions 
are true. They are complemented by elimination rules which allow us to obtain further 
knowledge from the knowledge of compound propositions. The elimination rules for a 
connective should be locally sound and complete in order to have a satisfactory meaning 
explanation for the connective. Local soundness and completeness are witnessed by local 
reductions and expansions of proofs, respectively. 

Note that there are other ways to define meaning. For example, we frequently expand 
our language by notational definition. In intuitionistic logic negation is often given as a 
derived concept, where -*A is considered a notation for A D _L. This means that negation 
has a rather weak status, as its meaning relies entirely on the meaning of implication and 
falsehood rather than having an independent explanation. The two should not be mixed: 
introduction and elimination rules for a connective should rely solely on judgmental 
concepts and not on other connectives. Sometimes (as in the case of negation) a connective 
can be explained directly or as a notational definition and we can establish that the two 
meanings coincide. 

3. Hypothetical Judgments and Implication 

So far we have seen two forms of judgment: " A is a proposition" and U A is true" . These 
are insufficient to explain implication, since we would like to say that A D B is true if B is 
true whenever A is true. For this we need hypothetical judgments and hypothetical proofs, 
which are new primitive notions. We simplify the account of hypothetical judgments by 
Martin-L6f by presupposing that subjects A and B are known to be propositions without 
making this explicit. 

We write the general form of a hypothetical judgment as 



which expresses "J assuming J\ through J„" or "J under hypotheses J\ through J, 



J\ , . . . , J n \~ J 
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We also refer to Ji , . . . , J n as the antecedents and J as the succedent of the hypothetical 
judgment. 

We explain the meaning by explaining what constitutes evidence for such a hypothet- 
ical judgment, namely a hypothetical proof. In a hypothetical proof of the judgment 
above we can use the hypotheses Ji as if we knew them. We can consequently substitute 
an arbitrary derivation of Jj for the uses of a hypothesis Ji to obtain a judgment which 
no longer depends on Ji. Thus, at the core, the meaning of hypothetical judgments relies 
upon substitution on the level of proofs, that is, supplanting the use of a hypothesis by 
evidence for it. 

The first particular form of hypothetical judgment we need here is 

Ai true, . . . , A n true h A true 

where we presuppose that Ai through A n and A are all propositions. We write T for a 
collection of hypotheses of the form above. The special case of the substitution principle 
for such hypotheses has the form 

Substitution Principle for Truth 

If T h A true and T, A true h J then T h J. 

In particular, we will be interested in the cases where the judgment J is C true or a 
hypothetical judgment fhC true. In the latter case, iterated hypothetical judgments are 
combined and the substitution principle postulates that if F h A true and F, A true, V h 
C true then T, T' h C true. We further have the general rule for the use of hypotheses. 

hyp 

T, A true, r h A true 

We emphasize that the substitution principle should not be viewed as an inference rule, 
but a property defining hypothetical judgments which we use in the design of a formal 
system. Therefore it should hold for any system of connectives and inference rules we 
devise. The correctness of the hypothesis rule, for example, can be seen from the substi- 
tution principle by adjoining unused hypotheses to the first derivation. In this paper we 
will not discuss the details of structural properties of collections of hypotheses such as 
weakening, exchange, or contraction. 

Now we can explain the meaning of implication at the level of propositions. First, the 
formation rule: 

A prop B prop 

DF 

Az) B prop 

We follow the usual convention that implication associates to the right, so Ad BdC 
stands for AZ)(B Z) C). The meaning of A D B is given by what counts as a verification 
of it. We say that A D B is true if B is true under hypothesis A. 

T, A true h B true 

Dl 

r h A D B true 

If we know that A D B is true we know that B is true under assumption A. If we have 
evidence for the truth of A we can discharge this assumption and obtain evidence for the 
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truth of B. 

T\- AdB true T h A true 

DE 

r h B true 

This elimination rule is locally sound and complete. Local soundness can be seen from 
the local reduction 

V 

- Ft im p 

£ V 



r, A true h B true 

- D i £ . & 

Th AdB true fh A true R fh B true 



DE 



r h B true 

where V is constructed from V by substituting £ for uses of the hypothesis A true. This 
takes advantage of the meaning of hypothetical proofs which rests on the substitution 
principle. ^ 

Local completeness can be seen from the local expansion 

-TV 

hyp 

T,A true h AD B true T, A true h A true 

rhiDB true T, A true h B true 

Di 

r h A D B true 

where V is constructed from V by adjoining the unused hypothesis A true to every 
judgment. 



3.1. Axiomatic Characterization 

For the sake of completeness, we recall the axiomatic characterization of implication by 
means of Modus Ponens 

h A D B true h A true 

mp 



h B true 
and the axiom schemas S and K. 

V- (A-dB-dC)d(AdB)dAdC true 
\- AdBdA true 

Deductions of these axioms in the form of proof terms can be found in Section 6. 



4. Categorical Judgments and Validity 

Now that we have introduced hypothetical judgments, we can single out categorical judg- 
ments, a term which goes back to Kant. In our situation they are judgments which do not 

t There is a small ambiguity here which arises since we may not be able to identify particular uses of 
hypotheses if there are several identical hypotheses. This will be resolved through the introduction of 
proof terms in Section 6. 
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depend on hypotheses about the truth of propositions. We introduce the new judgment 
that A is valid (written A valid) , presupposing that A is a proposition. Evidence for the 
validity of A is simply unconditional evidence for A. We use "•" to indicate an empty 
collection of hypotheses. 

Definition of Validity 

1 If • h A true then A valid. 

2 If A valid then F h A true. 

We allow r as hypotheses of the form Ai true in part (2) in order to avoid explicit 
structural rules such as weakening. 

Validity is a judgment on propositions whose meaning has already been explained via 
the notion of truth. Therefore this new judgment form is not particularly interesting 
unless we take the next step to allow hypotheses of the form A valid. Since order is 
irrelevant, we separate hypotheses about truth and validity and consider the hypothetical 
judgment 

B\ valid, . . ., B m valid; Ax true, . . . , A n true h A true. 

We use the semi-colon for visual clarity, and write A for a collection of validity assump- 
tions. In the rules, we restrict ourselves to proving judgments of the form A true (rather 
than A valid), which is possible since the latter is directly defined in terms of the former. 
The meaning of hypothetical judgments yields the general substitution principle: 

If A I- B valid and A, B valid h J then Ah J. 

Rewriting the first part in terms of truth, and making additional assumptions on truth 
explicit rather than absorbing them into J, we obtain the following version used in the 
remainder of this paper. 

Substitution Principle for Validity 

If A; • h B true and A, B valid; T h J then A; T h J. 

We also have a generalized hypothesis rule, again expressed in a form which establishes 
truth rather than validity, which can be justified from the definition of validity. 

; hyp* 

A, B valid, A'; T h B true 

It is sound, since evidence for the validity of B consists of a proof of B true from no 
assumptions about truth, to which we can adjoin the hypotheses A' and T. 

The next step is to internalize the categorical judgment as a proposition. We write OA 
for the proposition expressing that A is valid. 

A prop 

OF 

OA prop 

We follow the convention that □ binds more tightly than D, so that OAd B stands for 
(□^4) D B. The introduction rule just allows the step from the validity of A to the truth 
of OA, according to the definition of validity. 

A; • h A true 

□/ 

A; T h OA true 



F. Pfenning and R. Davits 



8 



The elimination rule is considerably more difficult to construct. Clearly, the rule 

A; T h DA true 



A; • h A true 



is unsound, since the hypotheses F in the premise are unjustified. We can construct a 
sound elimination rule such as 

A; T h DA true 



A; T h A true 

but this is too weak, that is, not locally complete. There is no local expansion since after 
the only possible elimination 

V 

V A;ThDAtrue 
A;ThDAtrue E 



A; T h A true 

we cannot prove A; T h DA true from the conclusion. An elimination rule which is locally 
sound and complete follows the pattern of the usual rules for disjunction or existential 
quantification: the knowledge that DA is true licenses us to assume that A is valid. 

A;T\-DAtrue A, A valid; T h C true 

A; T h C true 

Local soundness of this rule is easily verified by the following local reduction. 



V 

A; • h A true 



DI £ 



A; • h DA true A, A valid; T h C true A; T h C true 

A; T h C true 

where £' is constructed from £ by substitution of V for uses of the hypothesis that A is 
valid, following the derived substitution principle for validity. 
Local completeness is also a simple property. 

hyp* 

t-. A, A valid; ■ h A true 

V D □/ 

A-YVDAtrue ^ E A;T\-DAtrue A, A valid;T h DA true 

' DE 

A;T\-DAtrue 

This concludes the treatment of validity and propositions of the form DA. In order to 
discuss the computational interpretations of DA, we reexamine the rules with a proof 
term assignment in Section 6. 
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4.1. Summary of Formal System 

Since a number of applications of modal logic require only necessity, we summarize the 
formal system developed up to this point. We allow atomic propositions P without ad- 
ditional properties. 



Propositions A 
True Hypotheses T 
Valid Hypotheses A 



= P | A x D A 2 | OA 
= • | r, A true 
= ■ I A, A valid 



The basic judgments A true and A valid are combined in a hypothetical judgment 

A; T h A true 

subject to the inference rules below. 

hyp 

A; T, A true, V h A true 

A; T, A true h B true A;T h Ad B true A; T h A true 

A;T\- AdB true A;T h B true 

hyp* 

A, B valid, A'; T h B true 

A; • h A true A;T\- OA true A, A valid; T h C true 

al BE 



A; r h OA true A;T h C true 

This inference system satisfies the usual structural laws of exchange, weakening, and 
contraction, both for true and valid hypotheses. This can be shown trivially by structural 
induction. The guiding substitution principle can be expressed as a property of this formal 
system and also proven by induction over the structure of derivations. 

Theorem 1 (Substitution). 

The inference system for modal logic with implication and necessity satisfies: 

1 If A; T, A true, fhC true and A; T h A true then A; T,T'h C true. 

2 If A, B valid, A'; T h C true and A; • h A true then A, A'; T h C true. 

Proof. In each case by straightforward induction over the structure of the first given 
derivation, using weakening where necessary. □ 



4.2. Alternative Formulations 

We conclude this section with some remarks on two of Prawitz's formulations of natural 
deduction for modal logic (Prawitz, 1965, Chapter VI). His first formulation, in our 
notation, allows contexts of the form UA\ true, . . . , OA n true which we write as DT. 

□ r h A true T\-aA true 

□ r, T' h DA true r h A true 
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This pair of rules is locally sound, but not complete. Moreover, it violates the interpre- 
tation of F h A true as a hypothetical judgment, since 

hyp hyp 



P.PDDQh PDDQ P.PDDQhP 

DP 

P.PDDQh DQ 

and 

%J 

DQ h DQ 
□/! 

but after substitution of the first derivation for uses of in the second we obtain an 
invalid derivation: 

hyp hyp 

P,PDDQh PDDQ P,PDDQhP 

DP 

P,PDDQhDQ 

D/l? 

P,PDDQh DDQ 

A related lack of normal forms was noted by Prawitz himself and he introduced two 
further systems. The third system is related to the one by Bierman and de Paiva (1996) 
in which the introduction rule has the form 

T\-DAitrue ... T\-DA n true □ A 1 true, □ A n true h A true 



DI 2 
r h DA true 

Prawitz writes this rule as 

T\- A true 

n/ 3 

r h DA true 

with a side condition enforcing that the derivation of the premise can be decomposed as 
in Bierman and de Paiva's formulation. 

The failure of the substitution property in the first formulation can be traced to the 
restriction of the introduction rule to assumptions of the form □ Ai true when it should be 
Ai valid. The revised version is still less than satisfactory since it requires a simultaneous 
substitution, either in the syntax or in the side condition. 



4.3. Axiomatic Characterization 

Necessity can be characterized axiomatically by the inference rule of necessitation 

h A true 



nec 
h DA true 

together with the following three axioms (see, for example, (Vigano, 1997; Kobayashi, 
1997; Alechina et al., 1998)): 

h D(ADB)D(DADDB) true 
h DAZ)A true 
h dAdddA true 
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The derivations of these axioms in natural deduction is given in Section 6 in abbreviated 
form as proof terms. 

5. Possibility 

We may view hypotheses Ai true, . . . , A n true as describing knowledge of a given world. 
The judgment that A is valid can then be interpreted as expressing that A is true in a 
world about which we know nothing. In other words, A is necessarily true. Note that by 
verifying the truth of A without presupposing any knowledge, we can speak of necessary 
truth without circumscribing the totality of all conceivable worlds. The reasoning remains 
purely logical. 

A dual concept is that of possible truth. We say that A is possibly true if there is a world 
in which A is true. Unlike in classical logic, we have no reason to expect that possible truth 
would be definable propositionally in terms of necessary truth. It also appears difficult 
to analyze this concept judgmentally without reference to the existence of particular 
worlds. And yet it is possible to do so by employing a combination of hypothetical and 
categorical judgments. The critical insight for necessity came from considering how to 
establish that A is valid. Here we take the opposite approach and consider how to use the 
knowledge that A is possibly true. It means that there is a world in which A is true, but 
about which we know nothing else. Therefore, if we assume that A is true (but nothing 
else) and then conclude that C is possible, then C must be possible. If we write A poss 
for the judgment that A is possible we obtain: 

If A poss and A true h C poss then C poss. 

Note that we can only draw conclusions regarding the possibility of C, but not its truth. 
In the end, the only way we can establish that A is possible is to show that A is true. 

If A true then A poss. 

This reasoning may use hypotheses, so in the definition we write out the corresponding 
principles in a more explicit form. 

Definition of Possibility 

1 If T h A true then V h A poss. 

2 If r h A poss and A true h C poss then Y \- C poss. 

We are interested in considering both necessity and possibility together. They interact 
because they are both concerned with truth, relativized to worlds. If we decide that they 
both should refer to the same worlds, then the definition of possible truth is extended by 
allowing assumptions about validity. 

Definition of Possibility with Necessity 

1 If A; T I- A true then A; Y h A poss. 

2 If A; T h A poss and A; A true h C poss then A; Y h C poss. 

In part (2), the validity assumptions A are available for deriving C poss from A true. This 
is because they are true in all worlds and therefore, in particular, in the one in which A 
is assumed to be true. Note that part (2) has the form of a substitution principle and 
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will be used as such. This leads to the non-standard form of substitution introduced in 
Section 6. 

For the consideration of validity we needed to introduce a new form of hypothesis, 
A valid, but no new judgment to be derived. Here, instead, we do not need to introduce 
a new form of antecedent, only a new form of succedent, A poss. Next we internalize 
possibility as a propositional operator O. 

A prop 

■OF 



OA prop 

We use the same syntactic conventions as for □ . The introduction and elimination rules 
follow the ideas above at the level of judgments. 

A; T h A poss A; T h OA true A; A true h C poss 

■ OI OE 



A; T h OA true A; V h C poss 

Part (1) in the definition of possibility allows us to pass from A true to A poss. Instead of 
introducing an explicit inference rule, we make this step silently whenever appropriate in 
order to avoid excessive syntactic baggage. This is akin to the direct use of an assump- 
tion A valid to conclude that A true in the extended hypothesis rule hyp* . We similarly 
decorate the OI and OE rules with an asterisk when such a passage occurred in one of 
its premises. 

Local soundness can be seen from the local reduction 



V 

A; r h A poss 



A; T h OA true A; A true h C poss A; T h C poss 

OE 

A; T h C poss 

where £' is justified by part (2) in the definition of possibility. 

The elimination rule is also locally complete, as witnessed by the following expansion. 

hyp 

A; T h OA true A; A true h A true 

=> F OE* 

A; T h OA true * A; T h A poss 

OI 

A; T h OA true 

The substitution principle for validity, using the new judgment C poss as the succedent 
J, justifies a new variant of the necessity elimination rule. 

A; F h OA true A, A valid; V h C poss 



A; T h C poss 



■ UE p 



Without this rule the judgment • ; □ A true, 0(A D B) true h B poss, while derivable, would 
not have a derivation satisfying a strict subformula property. We leave the verification 
of local soundness when □/ is followed by OE p to the reader. As before, it follows from 
the appropriate instance of the substitution principle for validity. This concludes our 
meaning explanation of possibility. 
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5.1. Summary of Formal System 

We now summarize the formal system of modal logic with necessity and possibility. 



Propositions A 
True Hypotheses T 
Valid Hypotheses A 



P | A 1 dA 2 | aA | OA 

■ | r, A true 

■ | A, A valid 



The basic judgments A true, A valid, and A poss are combined in two forms of hypo- 
thetical judgment 

A; T h A true 
A; r h A poss 

subject to the inclusion of A true in A poss and the inference rules below. 

hyp 

A; T, A true, T h A true 

A; T, A true h B true A;T h Ad B true A; T h A true 

Dl DE 

A;T\- AdB true A;lhB true 

; hyp* 

A, B valid, A ; T h S irue 

A-hita A;ri-D4iree A, A wa/id; T h C true 

-□J DE 



A;T\-DAtrue ' A;T \- C true 

A;T\- a A true A, A valid; T h C poss 

— ■ —OE p 

A; T h C poss 

A;Th A poss A; T h OA frtte A; A irae h C poss 

OI 

A;fh04 irae A; T h C poss 



OS 



Again, this inference system satisfies the usual structural laws of exchange, weakening, 
and contraction, both for true and valid hypotheses. The appropriate instances of the 
defining substitution principle can be expressed as a property of this formal system and 
proven by induction over the structure of derivations. 

Theorem 2 (Substitution). 

The inference system for modal logic with implication, necessity, and possibility satisfies: 

1 If A; T, A true, V h C true and A; T h A true then A; T,T'h C true. 

2 If A; T, A true, V h C poss and A; T h A true then A; T, T' h C poss. 

3 If A, B valid, A';IhC true and A; • h A true then A,A';IhC true. 

4 If A, B valid, A';IhC poss and A; • h A true then A,A';IhC poss. 

5 If A; A true h C poss and A; T h A poss then A; F h C poss. 



Proof. In parts (1-4) by straightforward induction over the structure of the first given 
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derivation, using weakening and the inclusion of A true in A poss where needed. Part (5) 
follows by induction over the second given derivation. □ 

5.2. Alternative Formulations 

We could avoid introducing two separate elimination rules for necessity (DE and DE p ) 
with the single rule 

A; F h DA true A, A valid; T h J 

OEj. 

A; T h J 

Unfortunately such a rule would be impredicative, quantifying over all judgments J. We 
prefer to avoid this by using only those instances of the general schema relevant to our 
development. 

In our system propositional reasoning is explicit, while reasoning at the level of judg- 
ments is implicit. We can obtain another system by representing the definitions of the 
judgments as inference rules. 

A; • h A true A h A valid 

A h A valid A; T h A true 

A;T\- A true A; T h A poss A; A true h C poss 

A; T h A poss A; T h C poss 

For consistency, we would modify the rules concerned with validity as follows. 

hyp 

A, B valid, A'hB valid 

A^Avalid A;Th DAtrue A, A valid; T h C true 

□/ □ E 

A;T^DAtrue A;T\-Ctrue 

A;T\- DA true A, Avalid;T h C poss 

OE p 

A; T h C poss 

The difference appears to be primarily cosmetic. In practice it is more efficient to work 
with the compact rules of our original system. 

Even though they are not needed to develop modal logic, we can also allow hypotheses 
of the form A poss. Assumptions of this form are quite weak and do not seem to interact 
with the other judgments and propositions in interesting ways. 

5.3. Axiomatic Characterization 

Possibility can be characterized axiomatically by the following axioms. 

h A D OA true 
h OOA D OA true 
hD(ADB)D (OA D OB) true 
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Natural deductions for these axioms are given in abbreviated form as proof terms in the 
next section. 



6. Analytic and Synthetic Judgments 

Martin-L6f (1994) reviews the notions of analytic and synthetic judgments as analyzed 
by Kant. He states: 

/. . ./ an analytic judgement is one which is evident in virtue of the meanings of the terms that 
occur in it. 

The judgment A prop is analytic in this sense since we can easily construct evidence for 
the knowledge that A is a proposition from A itself without additional insight. However, 
the judgment A true is not analytic, but synthetic: we need to look outside the judgment 
itself for evidence, typically by searching for a proof of A. Proofs are essential in our 
use of logic in computer science, since they contain constructions and algorithms with 
computational contents. Therefore Martin-L6f (1980) bases his type theory on several 
analytic judgments. Again, we simplify* and consider "M is a proof term for A" (written 
M : A). It is important that M contain enough information to reconstruct the evidence 
for A true in the sense we have discussed so far. Consequently, the notions of local 
soundness and completeness, witnessed by local reductions and expansion, can now be 
rendered on the proof terms M. 

We will not repeat the full construction of the rules above, but merely summarize them 
in their analytic form. First, conjunction. 

M : A N : B 



(M, N) : A A B 



Al 



M :AAB M : AAB 
AE L AE R 

fst M : A snd M : B 

Local reduction and expansion should now be considered judgments on proof terms. We 
summarize them in a form typical of their use in computer science. 

fst (M, N) =^ R M 
snd (M, N) =>r N 

M-.AAB =^ e (fst M, snd M) 

The local expansion only makes sense when M is the proof of a conjunction, which is 
indicated in the rule. 

We will freely switch back and forth between the view of M as a proof and A as a 
proposition, or M as a term and A as its type. For the reductions we presuppose that 
each left-hand side is well-typed, which means the each corresponding right-hand side will 
also be well-typed and have the same type. This follows from the meaning explanation 
of conjunction given in its synthetic form. 



t Martin-L6f wrote M : proof(A) reserving the colon for the relationship between and object and its 
type. 
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For hypothetical judgments we label the assumptions with variables and write x:A for 
"x is a proof term for A" . We continue to use F to stand for a collection of hypotheses, 
now labeled, and call it a context. We suppose that all variables x declared in a con- 
text are different. We tacitly employ renaming to guarantee this invariant. Note that a 
judgment r h A true is parametric in all variables declared in V and thus combines the 
parametric and hypothetical judgment forms (Martin-L6f, 1996). The use of hypotheses 
and the substitution property are now as follows, where we write [N/x}M for the result 
of substituting N for x in M, renaming bound variables as necessary in order to avoid 
variable capture. 

hyp If T h N : A and T,x:A,T' h M : C 



T, x:A, r' h x : A ~ then r> r |_ [ N / X ] M : C. 

The rules for implication are annotated in the well-known manner, using functions and 
applications to realize implication introduction and elimination, respectively. 

T,x:AhM:B T h M : Ad B T h N : A 

Dl DE 



r h Xx:A. M : AZ) B V h M N : B 

The local reductions and expansions are just the familiar /3-reduction and 77-expansion. 

(Xx:A.M)N =^ R [N/x]M 

M : AD B Ax: A. M x where x not free in M 

As in type theory (Martin-L6f, 1980), the reduction rules have computational content, 
while the expansion rules implement an extensionality principle. 

To complete the proof term assignment, we need to label hypotheses of the form A valid. 
We write u::A to express that the variable u labels the hypothesis that A is valid. We 
continue to use A for a context of such assumptions, again presupposing that all variables 
labeling hypotheses in a judgment are distinct. Note that the judgment form u::A is never 
used as a succedent of a hypothetical judgment. We obtain the following hypothesis rule 
and substitution property. 

hyp* If A;-hiV: A and A,u::A, A';T h M : C 



A, u::A, A';T \- u : A ' then A, A'; T h \N/u\M : C 

Here we use the notation \N/u\M for the result of substituting N for uses of u in M, 
again renaming bound variables as necessary to avoid variable capture. It is defined like 
ordinary substitution — we use a different notation since it is derived from a different 
substitution principle and replaces another kind of variable. 

Next, we show the annotated forms of introduction and elimination rules and associated 
conversions. 

A;-\-M:A A; T h M : DA A, u::A; T \- N : C 

■ai uE 



A; T h boxM : OA A; T h let boxu = M in N : C 

let box u = box M in N =^ R {M/uj N 

M-.aA => E let boxw = M in boxw 
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To represent possibility, we need to add a new syntactic class E of proof expressions 
and judgment E A to express that E is a proof of A poss. We use E and F to stand 
for proof expressions. Since we know A poss whenever A true, every term M is also an 
expression E. The defining inclusion and substitution properties appear as follows: 

If A; T h M : A If A; T h E A and A; x:A h F + C 

then A ; rhMvi then A; T h {{E/x))F C 

The first property tells us that every proof term M is also a proof expression. The 
substitution operation ((E/x))F needed for the second property is unusual in that it must 
analyze the structure of E rather than F. We give a definition below, after introducing 
appropriate proof terms and local conversions for OA. However, it should not come as a 
surprise that such an operation is needed, since it is merely a reflection of clause (2) in 
the definition of possibility. 

A;ThE^A A; T h M : OA A;x:A\-E + C 

OI OE 

A;T\- di&E : OA A; T h let diaz = Min E C 

letdiax = dia£;in.F =^ R {{E/x))F 

M : OA => E dia(let diax = Min x) 

The substitution operation ((E/x))F must be defined in a non-standard way as hinted 
above. 

({M/x))F = [M/x]F 
((letdiay = Mm.E/x))F = let diay = Min {{E/x))F 

Note that these two cases are mutually exclusive: the first applies when the proof expres- 
sion is actually a proof term M, otherwise the second case must apply. 
We further annotate the derived elimination rule OE p 

A; T h M : DA A,u::A;T h E + C 

A; T h let boxu = MinE^C 
which yields one additional local reduction 

let boxu = boxM in E =^ R \M/u\E 
and a new case in the definition of substitution 

((let box u = M in E/x))F = let box u = M in {{E/x))F. 

6.1. Summary of Formal System 

We summarize the proof terms and rules for the analytic presentation of modal logic 
developed above. The reader should not forget that the methodology of type theory is 
open-ended by its very nature, and additional logical connectives can be added in an 
orthogonal manner. 
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Propositions A ::= P \ A x D A 2 \ OA \ OA 

Proof Terms M ::= x \ \x:A. M\M X M 2 

| u | boxM | let boxw = Mi in M 2 
| dmE 

Proof Expressions E ::= M 

| let diax = Min E 
| let box u = M in E 

True Contexts F ::= -\T,x:A 
Valid Contexts A ::= ■ \ A,u::A 

We have two judgments 

A; r h M : A M is a proof term for A true 
A;Th£vi iJisa proof expression for A poss 

where A; T h M + A whenever A; T h M : A. 

hyp 

A; T, x:A, V h x : A 

A; T, x:A \- M : B A;Th M : Ad B A;T \- N : A 

Dl DE 



A; T h Xx:A. M : Ad B A;T \- M N : B 

; hyp* 

A,u::A, A ;T \- u : A 

A;-\-M:A A; T h M : DA A,u::A;T h N : C 

■ai uE 



A; T h boxM : OA A; T h let boxu = M in N : C 

A; T h M : OA A, u::A: T h E + C 

■OE p 



A; T h let boxu = M in E + C 

A;ThE^A A; T h M : OA A;x:A\-E + C 

OI OE 



A;T h dia.E : OA A; T h let diax = Min E C 

We have three different forms of substitution: 

1 [M/x]N and [M/x]F which replace a variable a; by a proof term M, 

2 \M/u\N and [M/u].F which replaces a variable u by a proof term M, 

3 ((E/x))F which replaces a variable x by a proof expression E. 

The first two are defined in a standard fashion, including tacit renaming of bound vari- 
ables in order to avoid capture of variables free in M. The last is defined by three mutually 
exclusive clauses, one for each possible proof expression E. 

({M/x))F = [M/x]F 
((let diay = MinE/x))F = let diay = Min ((E/x))F 
((let box u = M in E/x))F = let box u = M in {{E/x))F 
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The guiding substitution principles can be expressed as a property. 

Theorem 3 (Substitution on Proof Terms and Expressions). 

The analytic inference system for modal logic with implication, necessity, and possibility 
satisfies: 

1 If A; T, x:A, V h N : C and A; T h M : A then A; V, V h [M/x}N : C. 

2 If A; r, x:A, V h F -J- C and A; V h M : A then A; T, T' h [M/x]F C. 

3 If A, u::B, A'; T h N : C and A; • h M : B then A, A'; F h \M/u\N : C. 

4 If A, u::B, A'; T h F C and A; • h M : B then A, A'; F h {M/u}F -r- C. 

5 If A; h F C and A; T h E + A then A; T h {{E/x))F + C. 

Proof. By straightforward induction over the structure of the first given derivation 
except in part (5), where the induction is on the second given derivation as in the proof 
of Theorem 2. □ 

Ordinary substitutions satisfy a distribution property of the form 

[M 1 /x 1 ][M 2 /x 2 ]M 3 = [[M 1 /x 1 ]M 2 /x 2 ][M 1 /x 1 }M 3 

under the assumption that x 2 is not free in M\. This follows by a simple induction on 
the structure of M3. Similar properties hold for substitutions of [Mi/iti] and [M\/xi] in 
various terms or expressions, because these are essentially capture-avoiding replacement 
operations. The new form of substitution ((E/x)} satisfies a corresponding law which we 
need in the proof of Theorem 7. 

Theorem 4 (Composition of Substitution). 

If A; T h Ex + Ai, A; xr-A-^ h E 2 -f- A 2 , and A; x 2 :A 2 hE 3 v A3, then 

{E 1 /x 1 ){E 2 /x 2 )E z = ((E 1 /x 1 )E 2 /x 2 )E 3 

Proof. By induction on the structure of E\ (not E%\), taking advantage of the straight- 
forward substitution properties mentioned above. Note that the typing preconditions do 
not impose any artificial restrictions; they just guarantee that both substitution opera- 
tions are sensible according to Theorem 3(5). □ 

The subject reduction and expansion theorem now follows easily from the substitution 
properties. The core of the proof is already contained in the local reductions we showed 
in the meaning explanation of the inference rules. We define M ==>r M' , E =>r E' , 
M => E M', and E =^ E E' by the following rules. 

(Ax A. N) M =^ R [M/x]N 

let box u = box M in N =^ R {M/ujN 

let diax = diaEin F =^ R \{E/x))F 

let box u = box M in F => R {M/u\F 

M : Ad B => e Ax A. Mx where x not free in M 
M-.aA => E let boxu = M in boxw 
M : OA =^ E dia(let diax = Min x) 
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Theorem 5 (Subject Reduction and Expansion). 

The modal A-calculus with implication, necessity, and possibility satisfies: 

1 If A; T h M : A and M =^ R N then A; T h N : A. 

2 If A; T h E A and E =^ R F then A; T h F A. 

3 If A; T h M : A and M : A =^ E N then A; T h AT : A. 

Proof. Parts (1) and (2) follow by simply inductions on the definition of =>#: for 
congruence rules, we apply to the induction hypothesis; for actual reductions we use the 
substitution properties 3. 

Part (3) follows similarly by induction, but no appeal to substitution is necessary. 
Instead we construct the needed derivation directly from the given one as in the local 
expansion on derivations. □ 

It is easy to see that the subject reduction property is preserved if we allow reductions 
to be applied at arbitrary subterms. For subject expansion this also holds if the subterm 
has the appropriate type. 

6.2. Some Examples 

We now revisit the axiomatic characterization of modal logic and give a proof term for 
each axiom. 

h Xx:AdBdC. Xy-.ADB. Xz:A. (x z) (y z) 
: (AZ)BZ)C)Z)(AZ)B)Z)AZ)C 

h Xx:A. Xy.B. x 

: AZ)BZ)A 

h Xx:D (Ad B). Xy:UA. let boxu = x in let box w — y in box (uw) 

: a(ADB)D(aADaB) 

h Xx:OA. let boxu = x in u 

: OAZ)A 

h Xx-nA. let boxu = x in boxboxu 

: OADOOA 

h Ax: A. diax 

: ADOA 

h Xx:<><>A. dia (let dia y = x in let dia z = y in z) 

: OOA^OA 

h Xx:0(Ad B). Xy:<>A. let boxu = x in dia (let diaz ~ y in uz) 

: □(4DB)D(0AD05) 

The inference rules of the axiomatic system are also easily realized. 



h M : AdB 



h N :A 



h M : A 



mp 



nec 



h MN : B 



h boxM : DA 
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7. Lax Logic 

Lax logic (Fairtlough and Mendler, 1997) is an intuitionistic logic with a single modal 
operator O. It was motivated by hardware verification (Fairtlough and Mendler, 1994) 
and has found applications in the foundations of constraint logic programming (Fairt- 
lough et al., 1997). It has also been related to the monadic metalanguage (Benton et al., 
1998), which we will examine in the next section, and to higher-order definitions of logical 
connectives (Aczel, 1999). 

We develop here the fragment of lax logic containing implication A => B and the lax 
modality OA. We use a different notation for implication than in modal logic, so we 
may later give the connective a different interpretation as lax implication. We will give 
two different explanations of lax logic. The first characterizes lax truth via judgments in 
the manner of the preceding sections. Our starting points are just the concepts of truth 
and hypothetical judgments. In particular, the presentation is independent of modal logic 
and categorical judgments. The second explanation uses necessity and possibility to show 
that lax truth is a derived notion, already available in modal logic. The fact that our 
formulation is equivalent to the standard formulation is proven in Section 8, where we 
also exhibit translations between proof terms. 

We begin with a judgmental definition of lax truth. We have a new judgment, A lax 
for a proposition A. We may think of A lax as stating that A is true subject to some 
constraints, without making explicit relative to which system of constraints. 

Definition of Lax Truth 

1 If T h A true then T \- A lax. 

2 If T h A lax and T, A true h C lax then T \- C lax. 

The first clause expresses that if A is true, then A is true under some constraint 
(namely: the constraint which is always satisfied). The second expresses that if A is true 
under some constraints, we may reason as if A were true. Any consequence we derive, 
however, will only be known as true under constraints. Internalizing this judgment as a 
propositional operator is simple. 

r h A lax r h OA true T, A true h C lax 

OI OE 

r h OA true T h C lax 

As for possibility, we allow silent passage from A true to A lax, and write OI* and OE* 
when this inclusion is used the premises of these rules. 
Local soundness is easily seen from the local reduction 

V 

r h A lax 

OI 1 

r h OA true T, A true h C lax 

OE 

ThC lax 



£' 

ThC lax 



where £' is justified by part (2) in the definition of lax truth. 
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The elimination is also locally complete, as witnessed by the following expansion. 

hyp 

r h 0^4 true r, A true h A true 

OE* 

r h A lax 

OJ 

rhOi true 

To provide more intuition, we return to the interpretation of A lax as A is true under 
some constraint. The following laws characterize lax logic axiomatically and have a simple 
interpretation in terms of constraints. 

1 h A => 0^4 true: If A is true, the A is true under the trivial constraint. 

2 h OOA => OA true: If A is true under two constraints than A is true under their 
conjunction. 

3 h (A => £?) => (OA => OB) irue: If A implies B, and A is true under some constraint, 
then B is true under the same constraint. 

The lax modality is very similar to possibility, but it differs in the proposition (A => 
B) => (OA => OB) which is not true for arbitrary A and B if we replace O by O. 
Instead, we only have h □(AdB)d(O j 4dOB). Similarly, in the elimination rule OE 
the hypotheses T are available in the second premise, while in OE only the hypotheses 
A on the validity of propositions are available in the second premise. 

This last observation provides a crucial insight for designing a direct interpretation 
of lax logic in intuitionistic modal logic. We use the embedding () + of propositions and 
hypotheses: 

(A^B)+ = OA+DB+ 
(OA)+ = OOA+ 

P + = P for atomic P 
(.)+ = . 
(T,Atrue)+ = T+,A+ valid 

In order to state the correctness of this interpretation of lax logic in modal logic, we write 
\^ for judgments in lax logic and for judgments in modal logic. 

Theorem 6 (Lax Logic in Modal Logic). 

r £ A true iff T+; • h M # true. 

Proof. From left to right, we show 

1 if T £ A true then T+; • h M 4+ true, and 

2 if T f A lax then T+; • UA+ poss 

by simultaneous induction on the structure of the given derivations. The inferences rules 
of lax logic become derived rules in modal logic, under the given translation on proposi- 
tions. 



V 

fl-Oi true 



> E 
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For the opposite direction we define a reverse translation () : 



(AdB)~ = A-^B- 

{UA)~ = A~ 

(OA)- = OA- 

P = P for atomic P 




which satisfies (A + ) = A. The two properties, 

1 ifA;T h M i true then A", T~ ^ A- true, and 

2 if A; T ^ A poss then A", T~ ^ A- lax, 

then follow by simultaneous induction on the given derivations. In this direction we need 
weakening and the substitution principle. From the assumption T + ; ■ \^ A + true we 
then conclude (r + )~ h (A + )~ true and therefore r h A true. □ 

The results above mean that we can define 

A^B = dAdB 
OA = ODA 

and then use modal logic for reasoning in lax logic. Since the rules of lax logic are derived 
(and not just admissible), we can retain the structure of proofs in the translation. We 
make this explicit in Section 8, where we revisit the above embedding, including proof 
terms. 

It remains to see if we can characterize lax implication and the lax modality directly in 
modal logic via introduction and elimination rules which are locally sound and complete 
and equivalent to the definitions above. 

For lax implication, this is easy to achieve and verify. 

A, A valid; T h B true A;Thi^B true A; • h A true 



In the elimination rule we use A ; • h A true to express that A h A valid, as in the 
introduction rule for necessity. Local soundness and completeness can be verified using 
the substitution principle for validity from Section 4. These rules are well-known from 
linear logic programming (Hodas and Miller, 1994), because in linear logic with a modal 
operator ! (which corresponds to □ in our setting), goal-directed search is incomplete. 
Replacing it by the analogue of lax implication avoids this problem and allows the use 
of intuitionistic linear logic as the basis of a logic programming language. 

The lax modality is more difficult to characterize by introduction and elimination 
rules in the presence of necessity and possibility and seems to require a new judgment 
A lax which we can also read as A is possibly necessary. This follows the blueprint of the 
definition of the lax modality, except that the interaction with the judgments of possibility 
and necessity requires laws relating them. In practice, it would seem preferable to either 
reason directly in lax logic as defined at the beginning of the section, or to reason in 



I 



A ; rhi^B true 



A; T h B true 
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modal logic with the defined modality of OA = On A and corresponding derived rules of 
inference. 



8. Monadic Metalanguage 

Moggi (1988; 1989; 1991) proposed the the monadic metalanguage A m ; as a general 
foundation for the semantics of programming languages with functions and effects. He 
separates, in the type system, values from computations, where the latter may have 
effects. The monadic metalanguage abstracts from any particular notion of effect (such as 
update of mutable references, or raising of exceptions). In this way, it is similar to modal 
logic which reasons about necessity and possibility, but abstracts from any particular 
collection of worlds. 

Benton, Biermann, and de Paiva (1998) showed that the monadic metalanguage is 
connected to lax logic via proof term assignment. We show the relevant fragment of the 
calculus here. We use the notation of lax logic, writing OA for the computations of type 
A, rather than TA or MA. 

hyp 

T,x:A,V h x : A 

r, x:A \- e : B TV-f:A^B rhe:i 

^E 



r h Xx:A. e : A=> B T h f e : B 

The: A T h e : OA T ,x:AY- } : OC 

■ OI OE 



TV- vale: OA T h let valx = ein / : OC 

We have the following two local reductions. 

(Xx:A. /) e =^ R [e/x]f 
let val x = val e in / =>r [ e / x ]f 

However, these do not suffice as the basis for an operational semantics, because of the 
unusual elimination rule for the lax modality. We need the following additional rule, 
which does not fall into the class of local reductions but has the form of a commuting 
reduction. 

Ietvalx2 = (let val xi = e\ in e 2 ) in e =>c let val a; i = e\ in (let valx 2 = e 2 in e) 

The local expansions are not computationally relevant, but correspond to extensionality. 
They are less problematic. 

e : A => B Ax: A. ex 

e : OA =^e let valx = ein valx 

We can fix the anomaly in the reduction relation through the judgmental reconstruction 
of lax logic in Section 7. We have two basic judgment forms M : A (M is a proof term for 
A true) and E^ A (E is a proof expression for A lax). The definition of the lax modality 
yields the following principles. 

If TV-M: A If T h E'V A and T, x:A h F'V C 

then T h M~ A then T h (E/x)F* C 



A Judgmental Reconstruction of Modal Logic 



25 



The first one means that we view proof terms and proof expressions as separate syn- 
tactic classes, where every proof term is a proof expression, but not vice versa. The 
introduction and elimination rules: 

T\-E^A T\-M:OA T,x:A\-E^C 

■ OI OE 



T\-v&\E:OA rh letvalx = Min 

Then the local reductions and expansions have the following form. 

(Ace: A M) N =^ R [N/x]M 
letvalx = valSin F =^ R {E/x)F 

M:A^B =^ E Xx:A.Mx 

M:OA =^ E val (letvalx = Min x) 

Lax substitution (E/x)F is defined inductively on the structure of E. 

(M/x)F = [M/x}F 
(let val y = Min E/x)F = let valy = M in (E/x)F 

We now show the proof terms for the characteristic axioms of lax logic. 

h Ax: A val A 

: A => OA 

h Ax:OOA val (let val y = x in let val z = y in z) 

: OOA => OA 

h Xx:A => B. Xy:OA. val (let val z = yin x z) 

: (A^B)^ (OA => OS) 

The following two mutually recursive translations from terms in the monadic meta- 
language to lax terms have several desirable properties, as we demonstrate below, e" is 
defined for arbitrary well-typed terms e, while e T is defined only for terms e whose type 
has the form OA 

x" = x 
(AxA. ef = AxA. e" 
(ei e 2 )" = e\ e\ 

(vale)" = vale" 
(let valx = ei in e 2 )" = val (let valx = e\ in e 2 ) T 

(let valx = ei in e 2 ) T = {sj /x)ej 

(vale) T = e" 

x T = let val xo = x" in xo 

(ei e 2 ) T = let valx 0 = (ei e 2 )" in xo 

We write <=> RE for the congruence relation generated by local reductions and expan- 
sions in the lax A-calculus, and <=>c and <==> R ec f° r ^ ne congruence relations generated 
by commuting conversion, and local reduction, expansion, and commuting conversion, 
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respectively, in the monadic metalanguage. We also write ^ and \^ for hypothetical 
judgments in the monadic metalanguage and lax logic, respectively. 

Theorem 7 (Monadic Metalanguage and Lax Logic). 

1 r f e : A iff r r* e» : A. 

2 T f e : OA iff T I 1 ' e T ~ A 

3 If e <£>* c f then = fK 

4 e^ REC fiKet^* RE fK 

Proof. The typing properties (1) and (2) follow by an easy simultaneous induction on 
the definition of the translations, using inversion on the given typing derivations. 

Part (3) confirms that the commuting reduction of the monadic metalanguage is not 
necessary in our formulation of lax logic — terms which differ by commuting reductions are 
actually equal (modulo the possible renaming of bound variables, as usual). This is easy 
to show by direct calculation, using elementary properties of substitution (Theorem 4) . 

Part (4) shows that the equational theory of the monadic metalanguage is respected 
by the translation. From left to right this follows by simple calculation for each possible 
conversion, using elementary properties of substitution. From right to left we define two 
reverse translations M b and E 1 - as follows: 

x b = x 

(\x:A. M) b = Xx:A. M b 

{M 1 M 2 ) b = M\M\ 

(val.E) b = E 1 - 

(let val x = M in E) 1 - = let val x = M b in E 1 - 
M 1 - = valM b 

We then show 

f if T ^ M : A then T f M b : A, and 
2 if T £ E A then r f E 1 - : OA. 

The reverse translation preserves equality, which follows by simple calculations: 

f If M <^* RE N then M b <^* REC N b . 

2 If E 4^* RE F then E^ <^* REC F^. 

3 {e*) b S^ REC e. 

Therefore, e» 4^* RE /» implies e <^* REC (e«) b <^* REC (/«) b <^* REC /• □ 

We also conjecture a strong relationship between reduction sequences in the two calculi 
under the given translation, even though a direct simulation theorem fails. A further 
study of computational behavior is beyond the scope of this paper. The similarity of 
our techniques and those by Sabry and Wadler (1997) suggest an approach we intend to 
pursue in future work. 

As an alternative to a direct term assignment for lax logic, we can use the embedding 
of lax logic in modal logic to give an account of the monadic metalanguage in modal 
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logic. A proposal along similar lines has been made by S. Kobayashi (1997), with an em- 
phasis on a categorical semantics. His natural deduction formulation, and therefore his 
programming language concepts, are not satisfactory. In particular, his system requires 
simultaneous substitutions in two rules to model validity (as in the system by Bierman 
and de Paiva (1996)), and also has a somewhat unmotivated interaction between pos- 
sibility and falsehood. Our formulation below eliminates the first deficiency and can be 
extended to avoid the second. 

We show the embedding from Section 7 on proof terms. First, we recall the embedding 
of propositions. 

(A^B)+ = OA+DB+ 
(OA)+ = OOA+ 

P + = P for atomic P 

Intuitively, the type OA denotes stable values, that is, values that survive effects. The 
type OA denotes computations returning values of type A. In the monadic metalanguage, 
all values are stable, so a function A =>■ B accepts a stable value of type A and returns 
a value of type B, while OA is a computation which returns a stable value of type A. It 
is not clear if the possibility to consider values which are not stable is of much practical 
interest, but it is conceivable, for example, that an effect such as deallocation of memory 
could destroy some values, while others survive. 

We assume that for every variable x:A in the lax A-calculus there is a corresponding 
variable u x ::A + in the modal A-calculus. We define the translations M + and E* . 

(\x:A. M)+ = \x:OA + . let boxit^ = x in M+ 

(MN)+ = M+(boxiV+) 
(v&lE)+ = dia£* 

(let valx = Min E)* = let diax = M+ in (let boxw^ = x in E*) 
M* = boxM+ 

We write M ==>r N for local reduction in the lax A-calculus, and M ==>r N for 
local reduction in the modal A-calculus. Moreover, we write M ==>Jj N for an arbitrary 
number of reductions. As before we use -^=^* RE for the congruence relation generated by 
local reduction and expansion. 

Theorem 8 (Lax A-Calculus in Modal A-Calculus). 

1 T r* M : A iff r+;- F M+ : A+ . 

2 r £ E^ A iff F E* OA+. 

3 If M=^ R N then M+ =^* R N+. 

4 If E =^ R F then E* =^* R F*. 

5 M 4^* RE N iff M+ <^U* RE N+ . 

6 E<^* RE F iff E* <^U* RE F*. 

Proof. The first two properties are verified as in the proof of Theorem 6. 
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The proof of the next two properties is by cases. We see that each reduction translates 
into precisely two consecutive reductions. Furthermore, if the original reductions are 
outermost, so are the two consecutive reductions on the image. This means that the 
structure of computations in the lax A-calculus is preserved under the interpretation. 

Finally, the preservation of equality from left to right is proven by cases, using elemen- 
tary substitution properties. From right to left we define two inverse translations, M~ 
and E % : 

(AdB)~ = A-^B- 
pA)- = A~ 
(OA)- = OA- 
P = P 

(Xx:A. M)~ = \x-.A-. M~ 
(Mi M 2 )~ = Mf M 2 ~ 

x" = x 

(boxM)" = M~ 
(let boxu = M in N)~ = [M~/x u ]N- 

11 x u 

(dia£)~ = val£ $ 
(let dia x = M in E) $ = let val x = M~ in E $ 
(let boxu = M in Ef = [M-/x u ]E $ 
M $ = M 

This translation satisfies 

1 li A;T ^ M : A then A- ,T- ^ M- : A- . 

2 If A;T \^ E + A then A-,r- ^ E $ ^ A- . 

3 (M+y = M. 

4 (E*) $ = E. 

5 If M ^U* RE N then M~ 4^* RE N~ . 

6 If E<^* RE F then E*^ RE F*. 

From this we directly conclude the reverse directions of the biconditionals in properties 
(5) and (6) of the theorem. □ 



9. Conclusion 

We have presented a judgmental reconstruction of the modal logic of necessity and possi- 
bility, leading to a clean and simple formulation of natural deduction and associated proof 
terms. Because the definitions of logical connectives are orthogonal in this approach, other 
propositional connectives can easily be added with their usual introduction and elimina- 
tion rules. We plan to investigate extensions to first-order logic and type theory, which 
require parametric judgments and more attention to the question when propositions are 
well-formed. We have also left the study of various normalization properties, as well as 
a formulation of a sequent calculus and cut elimination to a future paper. 
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The idea of separating truth and validity in a logical framework goes back to Avron 
et al. (1992) and is explored further by Miculan (1997). These systems, however, are 
rooted in Prawitz's (1965) classical treatment and do not take full advantage of the 
available judgmental notions. The resulting calculi are significantly more complex than 
our proposal and not immediately amenable to a computational interpretation. 

Another approach to the explanation of modal logic is via Kripke structures. This 
uses the basic judgments "proposition A is true in world w" , and "world w' is reachable 
from world w" . While more verbose and requiring explicit reasoning about worlds, this 
approach is also more flexible in that various traditional modal logics can be expressed 
simply by varying the reachability judgment. Vigano (1997) and Miculan (1997) have 
conducted systematic studies of modal logic via Kripke structures from the point of view 
of logical frameworks. 

In certain cases this can be simplified to obtain a formulation of natural deduction 
employing a stack of contexts, representing a path through the Kripke structure. Varia- 
tions of this idea can be found in several papers (Martini and Masini, 1994; Pfenning and 
Wong, 1995; Davies and Pfenning, 2000), including a very fine-grained study of reduc- 
tion (Goubault-Larrecq, 1996; 1997). These are natural for some applications of necessity, 
but it does not appear that similarly compact and elegant versions exist for possibility. 

One particularly fruitful interpretation of OA is as the intensional type for expressions 
denoting elements of type A. Embedding types of this form in a programming language 
means that we can compute with expressions as well as values. The term box M quotes 
the expression M, and the construct let boxu = M in N binds u to the expression 
computed by M and then computes the value of N. The restrictions placed on the 
introduction rule for OA mean that a term box M can only refer to other expression 
variables u but not value variables x. This is consistent with the intensional interpretation 
of OA, since we may not know an expression which denotes a given value and therefore 
cannot permit an arbitrary value as an expression. 

The local reduction rules can be extended to an operational semantics by imposing a 
call-by-name or call-by- value strategy. In either case, we do not permit reductions under 
a box constructor, since this would violate its intensional nature. 

If we choose a call-by- value strategy, we obtain a natural explanation of computation 
in multiple stages and, at a lower level, run-time code generation (Davies and Pfen- 
ning, 1996; Wickline et al., 1998; Davies and Pfenning, 2000). Alternatively, we can add 
constructs for pattern matching against an expression. If we also retain extensionality 
as given by the local expansions, we can obtain a calculus suitable as a meta-logical 
framework, that is, a logical framework in which we can reason about the specified log- 
ics (Despeyroux et al., 1997). The modal operator here serves to avoid the usual paradoxes 
which would arise if we incorrectly identify an expression with its denotation. 

In this paper we have also shown how lax logic can be embedded naturally in modal 
logic with necessity and possibility. Following work by S. Kobayashi (1997) and Benton, 
Bierman, and de Paiva (1998), this yields a new formulation of Moggi's monadic meta- 
language (1988; 1989; 1991). A possible future direction of research is to try to exploit 
the additional expressive power afforded by the modal logic as a semantic framework 
when compared to the monadic metalanguage. 
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